policy static nat

giuseppe parlato — Mon, 11 Mar 2019 23:44:59 GMT

Hello, I have a question regarding policy static nat,

lets suppose I have source 10.1.1.1/32 natted 20.1.1.1/32 with destination 30.0.0.0/8

it means that 10.1.1.1 going to 30.0.0.0/8 will be natted 20.1.1.1 and 30.0.0.0/8 can reach 10.1.1.1/32 through natted ip 20.1.1.1

.. my doubt is .. is that enough (acl applied to nat) or do I also have to apply acl to interface allowing traffic from 30.0.0.0/8 to 20.1.1.1 ?

testing with packet trace seems to be it is not enough.

thanks

Julio Carvajal — Wed, 22 Aug 2012 05:38:24 GMT

Hello,

As long as an outbound connection has been created the returning traffic will be allowed for the existing connection.

Are you using a static policy nat?

Are you trying to innitiate a connection from the other side ( 30.x.x.x)

topic policy static nat in Network Security